CVE-2026-44595

MEDIUM

YAMCS yamcs-core 5.12.7 - User Enumeration

STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-44595. PoCs published by Daniel Miranda, ex-cal1bur.

AI-analyzed exploit summary This Python script demonstrates CVE-2026-44595, an unauthorized user enumeration vulnerability in YAMCS yamcs-core < 5.12.7. It authenticates as a low-privilege user and exploits unenforced access controls on IAM API endpoints to enumerate users and groups.

Description

Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0.

Exploits (2)

exploitdb WORKING POC
by Daniel Miranda · pythonwebappsmultiple
https://www.exploit-db.com/exploits/52604

This Python script demonstrates CVE-2026-44595, an unauthorized user enumeration vulnerability in YAMCS yamcs-core < 5.12.7. It authenticates as a low-privilege user and exploits unenforced access controls on IAM API endpoints to enumerate users and groups.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: YAMCS yamcs-core < 5.12.7
Auth required
Prerequisites: Valid low-privilege user credentials
mistral-large-3 · analyzed May 31, 2026 Full analysis →
nomisec WORKING POC
by ex-cal1bur · poc
https://github.com/ex-cal1bur/CVE-2026-44595

The repository contains a functional Python PoC that demonstrates CVE-2026-44595, an unauthorized user enumeration vulnerability in YAMCS IAM API endpoints due to missing authorization checks. The PoC authenticates as a low-privilege user and enumerates all users and groups, confirming the vulnerability.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: yamcs-core < 5.12.7
Auth required
Prerequisites: Valid YAMCS instance with at least one low-privilege user account
mistral-large-3 · analyzed Jul 02, 2026 Full analysis →

Scores

CVSS v3 4.3
EPSS 0.0098
EPSS Percentile 58.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (2)
spaceapplications/yamcs < 5.12.7
yamcs/yamcs < 5.12.7
Published Jul 16, 2026
Tracked Since May 31, 2026